Important: ecs-init

Issue Overview: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-037)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-037 advisory. Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling...

PT-2024-9646 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.0 Description: The issue is related to a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that lead to sensitive...

CVE-2021-47536

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix wrong listdel in smclgrcleanupearly smclgrcleanupearly meant to delete the link group from the link group list, but it deleted the list head by mistake. This may cause memory corruption since we didn't remove the rea...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 to update your system. New Packages: aarch64: ecs-init-1.70.1-1.amzn2023.aarch64 src: ...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 or dnf update --advisory ALAS2023-2024-620 --releasever 2023.4.20240513 to update your system. More informati...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-619)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-619 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-620)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-620 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Elevating Security: Qualys Unveils First Solution for Scanning AWS Bottlerocket in Amazon EKS and Amazon ECS

With this new offering, Qualys establishes itself as the first and only vendor solution with the unique ability to scan AWS Bottlerocket instances directly using the Qualys Cloud Agent and TotalCloud Agent-less Snapshot-Based Scan. This innovative capability empowers organizations to...

DELL ECS Connection Manager 安全漏洞

DELL ECS Connection Manager is a software for managing enterprise cloud storage from Dell DELL USA. A security vulnerability exists in DELL ECS Connection Manager that stems from the use of a reversible password encryption algorithm that allows an attacker to decrypt passwords...

DELL ECS Connection Manager 安全漏洞

DELL ECS Connection Manager is a software from Dell USA for managing enterprise cloud storage. A security vulnerability exists in DELL ECS Connection Manager that originates from allowing an unauthenticated attacker to access computers on the same network in an HA or cluster group via an IP...

Malicious code in ecs-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 308d5a6fa5eb0973b0ff8290c321ac60685b686f42543a7a09b16a5fe56a7457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1287 Malicious code in ecs-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 308d5a6fa5eb0973b0ff8290c321ac60685b686f42543a7a09b16a5fe56a7457 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-5195 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.1 Description: The issue is related to insufficient access control in the Dell EMC Elastic Cloud Storage ECS platform, which can be exploited by a remote attacker to elevate their privileges. A high-privileged...

PT-2025-16951 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.8.1.4 and prior Description: The issue is related to an Improper Certificate Validation, which could be exploited by an unauthenticated attacker with adjacent network access, potentially leading to information disclosure...

PT-2025-16950 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.8.1.4 and prior Description: The issue is related to an Improper Input Validation, which could be exploited by a low-privileged attacker with remote access, potentially leading to code execution. Recommendations: For Dell...

Performance Degradation

BIND is vulnerable to a performance degradation issue when a resolver cache contains a large number of ECS EDNS Client Subnet records for the same name, impacting query performance during the cache database cleanup process...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-034)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-034 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happ...